wannacry | edd1fbcf42000838a7cb6bc32d4f41d8c2f894c0e749f0239b238d0432d0bf92

Analysis

Target

WannaCry/Trojan-Ransom.Win32.Wanna.m.12cb506898dac8a271c8b940a9a3dfba.dll
Size

5.0MB
MD5

12cb506898dac8a271c8b940a9a3dfba
SHA1

9c725b90c61f8c50d8f43e3f353e2874e9e8297b
SHA256

06397866c0315d894b742ff60416ca0c734344d9586752a6ee35279bb2907cd0
SHA512

03c1eb1f3d4232e08a718feb48b87535be6fba7aba752fed909d4933e9654ee1fa3a6909eaf5da312dfe6e16d1c33433f0b11f840d6e3559652b6e98ebc05589

Score

10^/10

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

3360 mssecsvc.exe
4176 mssecsvc.exe
4072 tasksche.exe

Drops file in System32 directory 7 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	mssecsvc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	mssecsvc.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\BUHSCW1A.cookie	mssecsvc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\BUHSCW1A.cookie	mssecsvc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	mssecsvc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	mssecsvc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4964 wrote to memory of 5064	4964	rundll32.exe	rundll32.exe
PID 4964 wrote to memory of 5064	4964	rundll32.exe	rundll32.exe
PID 4964 wrote to memory of 5064	4964	rundll32.exe	rundll32.exe
PID 5064 wrote to memory of 3360	5064	rundll32.exe	mssecsvc.exe
PID 5064 wrote to memory of 3360	5064	rundll32.exe	mssecsvc.exe
PID 5064 wrote to memory of 3360	5064	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WannaCry\Trojan-Ransom.Win32.Wanna.m.12cb506898dac8a271c8b940a9a3dfba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4964

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:4072

C:\WINDOWS\mssecsvc.exe
MD5
3a06598f40723548b15ccceb7daf7e69

SHA1
82feedee571047ac00055c48d5edb5e48d16d63d

SHA256
83fa1792f4d403da50c3372f3cf29a539fe9f89667f4a4fe26961ea55c77d1fe

SHA512
c759d7bdbd0f0df2043f1ddb4e8b741f08df0f012670ff1cbd1f163643a4ff1dcc8cde0e80a649051e444b3d2c23f31826a3f0371029feda21eadf14b34ead02

Download Submit
C:\Windows\mssecsvc.exe
MD5
3a06598f40723548b15ccceb7daf7e69

SHA1
82feedee571047ac00055c48d5edb5e48d16d63d

SHA256
83fa1792f4d403da50c3372f3cf29a539fe9f89667f4a4fe26961ea55c77d1fe

SHA512
c759d7bdbd0f0df2043f1ddb4e8b741f08df0f012670ff1cbd1f163643a4ff1dcc8cde0e80a649051e444b3d2c23f31826a3f0371029feda21eadf14b34ead02

Download Submit
C:\Windows\mssecsvc.exe
MD5
3a06598f40723548b15ccceb7daf7e69

SHA1
82feedee571047ac00055c48d5edb5e48d16d63d

SHA256
83fa1792f4d403da50c3372f3cf29a539fe9f89667f4a4fe26961ea55c77d1fe

SHA512
c759d7bdbd0f0df2043f1ddb4e8b741f08df0f012670ff1cbd1f163643a4ff1dcc8cde0e80a649051e444b3d2c23f31826a3f0371029feda21eadf14b34ead02

Download Submit
C:\Windows\tasksche.exe
MD5
2446b90fc9948edd0cb7aec7cc402b2f

SHA1
5b7376994d7cec68013b303d9671ad7f6e17452b

SHA256
4157731117ba81182c3eb458ae365ab7e95b6ea09ccbbb1d72f9a14ff986ed46

SHA512
16c520477e2bd1516dd690e9811186fc2779d6cf5e2a7491abe776a5f582b1d89560c6441bda8dcf1c3ceed0cb69eee0054371fb7adb271e0c423ff09672448b

Download Submit
memory/3360-3-0x0000000000000000-mapping.dmp

Download
memory/5064-2-0x0000000000000000-mapping.dmp

Download